configuring meta-attributes in the Shib IdP

[Cantor, Scott]

On 12/3/15, 5:03 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:


>On 12/3/15, 4:33 PM, "dev on behalf of Tom Scavo" <dev-bounces at shibboleth.net on behalf of trscavo at gmail.com>
>>
>>Then the following configuration at the IdP would recognize the above
>>requested attributes:
>>
>><afp:AttributeFilterPolicy id="releaseEssentialAttributesToAnySP">
>>
>>  <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
>
>I would assume that *that's* where you put the new fancy rule. Not ANY. The attribute rules are left as the more usual "permit ANY".
>
>So you have a policy for each RequestedAttribute, essentially, instead of one ANY policy containing all the rules.
>
>I don't believe that your way will work, but it might. I think it will be less efficient though.

I think I'm wrong and you're right. I'd start with yours anyway. Mentally my way is making more sense to me, but Rod understands the whole dual nature of the filter system and the attribute rules vs. policy rules better than I do, and I don't know if my way would work. I'd have to give it a try.

-- Scott